---
title: "A protocol born in 1981 just squashed a 34-year-old bug"
locale: "en"
url: "https://irz.fr/en/articles/ckermit-11-frog-protocol-en"
markdown_url: "https://irz.fr/en/articles/ckermit-11-frog-protocol-en.md"
category: "tech"
tags: ["open source", "protocols", "software history", "C-Kermit", "maintenance"]
published_at: "2026-08-25T17:10:00.000Z"
author: "Camille Morel"
translation: "https://irz.fr/fr/articles/ckermit-11-protocole-grenouille-fr.md"
---

# A protocol born in 1981 just squashed a 34-year-old bug

Fifteen years after the last stable release, C-Kermit 11 ships with more than 1,700 automated tests, IPv6 and a fix for a bug introduced in 1992. A look at forty-five years of a file-transfer protocol.

On April 29, 1981, two DECSYSTEM-20s at Columbia University traded their first bytes over a plain null-modem cable. On August 3, 2026, the protocol born in that moment shipped version 11. Between those dates: forty-five years, three homes and one frog.

C-Kermit 11 (11.0.506) is the first stable release since 2011; everything that shipped in between, after 9.0.302, carried a beta label[1](https://github.com/OpenKermit/ckermit/releases/tag/v11.0.506)[6](https://lwn.net/Articles/1086953/). The announcement opens with a dedication you rarely see in a changelog: "Frank was directly involved with Kermit for 44 years, from its initial design in 1981 all the way through 2025," writes John Goerzen about Frank da Cruz, who co-created the protocol[1](https://github.com/OpenKermit/ckermit/releases/tag/v11.0.506).

One more release, you might say. Except this particular software still updates firmware, runs factory machines and talks to pocket calculators. Good enough reasons to pop the hood.

> Illustration: Close-up photo of a Kermit the Frog puppet. The protocol owes its name to a Muppets calendar on a Columbia wall in May 1981, used by permission of Henson Associates. Credit: [Pattie / Wikimedia Commons, public domain](https://commons.wikimedia.org/wiki/File:Kermit_puppet.jpg).

## Two DECs and a cable

Kermit started as an inventory problem. In 1981, Columbia's computer center ran DEC and IBM mainframes side by side and was about to put CP/M "Superbrain" microcomputers into a public terminal room. None of these worlds shared a file format, or even a character set[2](https://www.kermitproject.org/fortieth.html).

The requirements came from Frank da Cruz, manager of the DEC-20s and Catchings' boss at the time: a robust, platform-independent protocol that could carry binary as well as text, even over bad lines. Catchings worked out the protocol, then wrote the first two implementations, one for the DEC-20 and one for CP/M. On April 29, 1981, two DECSYSTEM-20 Kermit instances transferred a file through a null-modem cable. A few weeks later came the first "real" transfer, between a DEC-20 and a Superbrain[2](https://www.kermitproject.org/fortieth.html).

The name arrived in May, facing the Muppets calendar on the wall. By da Cruz's own account, nobody in the group expected the software to leave the university, let alone last for decades[3](https://www.kermitproject.org/about.html).

## Built for bad lines

The original constraints explain almost everything after them. Packets under 100 bytes, because some systems choked on longer bursts, plus printable encodings for links that were not 8-bit clean. Character-set conversion between ASCII and EBCDIC had to come along too, because IBM mainframes did not write files like anyone else[2](https://www.kermitproject.org/fortieth.html)[3](https://www.kermitproject.org/about.html).

And every session opens by negotiating what each end can do. That single choice made the protocol extensible: long packets, sliding windows and streaming mode arrived years later without breaking old clients[3](https://www.kermitproject.org/about.html). Today a packet can reach roughly 9 KB[4](https://www.openkermit.org/faq/).

That is what took Kermit where faster protocols refused to go. In 2002-2003, the CSLM-2 microgravity experiment aboard the International Space Station pulled its data off an embedded MS-DOS box onto a Windows laptop over RS-232 at 38,400 baud, using Kermit. The ZIN Technologies engineer behind it reports that a custom "3.16 Beta 12-NASA" build, adapted by Joe Doupnik to run headless, was delivered within days[5](https://kermitproject.org/nasa.html). According to the project's own documentation, the protocol also runs factory equipment, including a tape layer that forms structural parts of the Boeing 787[3](https://www.kermitproject.org/about.html).

## Three homes

> **Forty-five years, three homes**
> - First transfer at Columbia.: 1981
> - Columbia steps back; the code goes open source.: 2011
> - Frank da Cruz retires.: 2025
> - Open Kermit ships version 11.: 2026
> Sources: Kermit Project, Open Kermit, GitHub announcement.

From 1984 on, Columbia required the project to fund itself. By da Cruz's published accounts, it brought the university $8.89 million; Kermit 95, the only strictly commercial piece, sold more than a quarter million bulk-license seats alone[3](https://www.kermitproject.org/about.html).

On July 1, 2011, Columbia canceled the project. All the software went under a BSD-style open source license, and the site moved to the Panix host. Da Cruz, laid off that same year as the last remaining member, kept going alone and unpaid[2](https://www.kermitproject.org/fortieth.html)[3](https://www.kermitproject.org/about.html).

In 2025 he retired from the protocol after 44 years. Nothing had been released since[4](https://www.openkermit.org/faq/). The next era grew out of a very concrete frustration: John Goerzen, Debian's Kermit maintainer, was spending his time passing security patches to distributions by hand, and it was becoming unmanageable. He created Open Kermit, the protocol's third home, with a GitHub repository and proper documentation[4](https://www.openkermit.org/faq/)[7](https://fossforce.com/2026/08/at-45-years-old-c-kermit-gets-its-first-new-release-in-15-years/).

## Bug archaeology

Before changing anything, Goerzen built safety nets: C unit tests, a Python regression suite, more than 1,700 cases running continuously on Linux, macOS, FreeBSD and NetBSD. And one detail that sums up the whole effort, compatibility tests against gkermit, E-Kermit and C-Kermit 9.0.302 from 2011[1](https://github.com/OpenKermit/ckermit/releases/tag/v11.0.506). Software that claims to talk to everything should verify it still talks to its own past.

> C-Kermit 11
> **Nets before any patch**
> - automated test cases: 1,700+
> - systems tested continuously: 4
> - birth year of the oldest fixed bug: 1992
> - net lines removed from the codebase: −2,600
> Source: C-Kermit 11 GitHub announcement.

The findings read like a core sample. A data-corruption bug caused by misusing strlen(), introduced in 1992 in C-Kermit 5A(188), has just been fixed[1](https://github.com/OpenKermit/ckermit/releases/tag/v11.0.506). A transfer hang dated back to Beta.05 of 2022[1](https://github.com/OpenKermit/ckermit/releases/tag/v11.0.506). Pseudoterminal problems on macOS had lingered for decades[1](https://github.com/OpenKermit/ckermit/releases/tag/v11.0.506). And NetBSD wins the prize for strangest: its kernel can report writing more bytes to a pty than actually went through. In default mode, C-Kermit now detects the loss and shrinks its packet size on its own to compensate[1](https://github.com/OpenKermit/ckermit/releases/tag/v11.0.506).

Despite the additions (IPv6 with graceful IPv4 fallback, OpenSSL 3.x and 4.x support, serial speeds up to 4 Mbps, static musl binaries for amd64 and arm64, Android support), the codebase comes out about 2,600 lines shorter than the last 10.x beta. In plain terms: the dead code removed outweighed the features added[1](https://github.com/OpenKermit/ckermit/releases/tag/v11.0.506).

## Defaults catch up

Version 11 also retires aged defaults, listing them honestly among the "rarely if ever" felt behavior changes[1](https://github.com/OpenKermit/ckermit/releases/tag/v11.0.506). The headline fix carries a number: CVE-2025-68920. Historical settings allowed a malicious remote Kermit server to perform actions on your local machine[1](https://github.com/OpenKermit/ckermit/releases/tag/v11.0.506). File collision handling moves from BACKUP to REJECT: previously, a hostile server could overwrite sensitive local files, .bashrc included[1](https://github.com/OpenKermit/ckermit/releases/tag/v11.0.506). Automatic transfer mode, which guessed text versus binary from file extensions and has already caused data loss, is now off by default[1](https://github.com/OpenKermit/ckermit/releases/tag/v11.0.506). And receiving a file whose name you never explicitly requested now asks for confirmation first[1](https://github.com/OpenKermit/ckermit/releases/tag/v11.0.506).

My reading: a protocol designed for institutional serial links assumed polite counterparts. The world of 2026 is not always polite, and the fix went into default values rather than into the protocol itself. Old habits remain available: launching the binary as kermit9 or kermit10 restores the previous settings[1](https://github.com/OpenKermit/ckermit/releases/tag/v11.0.506).

In his dedication, Goerzen writes that Kermit "glued systems together, from the International Space Station to pocket calculators"[1](https://github.com/OpenKermit/ckermit/releases/tag/v11.0.506). The line still stands, and the new compatibility suite takes it literally: the 2026 release against the 2011 one, on the same cable.

## References

1. [John Goerzen, C-Kermit 11.0 (11.0.506) release announcement, GitHub, August 3, 2026](https://github.com/OpenKermit/ckermit/releases/tag/v11.0.506)
2. [Frank da Cruz, "Kermit Protocol 40th Anniversary", Kermit Project, April 29, 2021](https://www.kermitproject.org/fortieth.html)
3. [Frank da Cruz, "About Kermit", Kermit Project](https://www.kermitproject.org/about.html)
4. [Open Kermit Project, FAQ](https://www.openkermit.org/faq/)
5. [Dave Hall (ZIN Technologies), "Kermit Supports NASA on the International Space Station", August 2003](https://kermitproject.org/nasa.html)
6. [LWN.net, "C-Kermit 11 released", August 3, 2026](https://lwn.net/Articles/1086953/)
7. [Christine Hall, "At 45-Years-Old, C-Kermit Gets Its First New Release in 15 Years", FOSS Force, August 5, 2026](https://fossforce.com/2026/08/at-45-years-old-c-kermit-gets-its-first-new-release-in-15-years/)